index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1964a4b3a6dOd12d7ccee57658Oeba11 ","4d4a0052d093cc743db0776e04f7e449 ","3c7c684aed7O164d9b9bbdebee964db4 ","4b11f89O119f7cbd131da26864f593bO ","884df847e417525Oa5a5c3eOedO83cfO ","19699828bd5ee7c8ebaa69cbOcd52e8e ","3O9267125434e8a4dO3af44f53818bb7","fb8bcbb48c36cc6c2f41O21d8e68efbc ","a1bffO8cd61471ecObO981eb31511b4a","2f64777bc62ea978b1ae98O2b4979cO4 ","5d9756e3f4c8e89ff23f7cab3Oc8c168 ","2337O46O839ad99ba513eb1595287f7f","7944332e65ad32d7b8O2e182346f5f1c","B41a248efde3dcOOf4b639da7f76fae1","7a9118O7Obae21eO323f343da1dOf8c9","D3864196cfO5bb812b27e698222df5aa")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1964a4b3a6dOd12d7ccee57658Oeba11 ","4d4a0052d093cc743db0776e04f7e449 ","3c7c684aed7O164d9b9bbdebee964db4 ","4b11f89O119f7cbd131da26864f593bO ","884df847e417525Oa5a5c3eOedO83cfO ","19699828bd5ee7c8ebaa69cbOcd52e8e ","3O9267125434e8a4dO3af44f53818bb7","fb8bcbb48c36cc6c2f41O21d8e68efbc ","a1bffO8cd61471ecObO981eb31511b4a","2f64777bc62ea978b1ae98O2b4979cO4 ","5d9756e3f4c8e89ff23f7cab3Oc8c168 ","2337O46O839ad99ba513eb1595287f7f","7944332e65ad32d7b8O2e182346f5f1c","B41a248efde3dcOOf4b639da7f76fae1","7a9118O7Obae21eO323f343da1dOf8c9","D3864196cfO5bb812b27e698222df5aa")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1964a4b3a6dOd12d7ccee57658Oeba11 ","4d4a0052d093cc743db0776e04f7e449 ","3c7c684aed7O164d9b9bbdebee964db4 ","4b11f89O119f7cbd131da26864f593bO ","884df847e417525Oa5a5c3eOedO83cfO ","19699828bd5ee7c8ebaa69cbOcd52e8e ","3O9267125434e8a4dO3af44f53818bb7","fb8bcbb48c36cc6c2f41O21d8e68efbc ","a1bffO8cd61471ecObO981eb31511b4a","2f64777bc62ea978b1ae98O2b4979cO4 ","5d9756e3f4c8e89ff23f7cab3Oc8c168 ","2337O46O839ad99ba513eb1595287f7f","7944332e65ad32d7b8O2e182346f5f1c","B41a248efde3dcOOf4b639da7f76fae1","7a9118O7Obae21eO323f343da1dOf8c9","D3864196cfO5bb812b27e698222df5aa")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1964a4b3a6dOd12d7ccee57658Oeba11 ","4d4a0052d093cc743db0776e04f7e449 ","3c7c684aed7O164d9b9bbdebee964db4 ","4b11f89O119f7cbd131da26864f593bO ","884df847e417525Oa5a5c3eOedO83cfO ","19699828bd5ee7c8ebaa69cbOcd52e8e ","3O9267125434e8a4dO3af44f53818bb7","fb8bcbb48c36cc6c2f41O21d8e68efbc ","a1bffO8cd61471ecObO981eb31511b4a","2f64777bc62ea978b1ae98O2b4979cO4 ","5d9756e3f4c8e89ff23f7cab3Oc8c168 ","2337O46O839ad99ba513eb1595287f7f","7944332e65ad32d7b8O2e182346f5f1c","B41a248efde3dcOOf4b639da7f76fae1","7a9118O7Obae21eO323f343da1dOf8c9","D3864196cfO5bb812b27e698222df5aa")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1964a4b3a6dOd12d7ccee57658Oeba11 ","4d4a0052d093cc743db0776e04f7e449 ","3c7c684aed7O164d9b9bbdebee964db4 ","4b11f89O119f7cbd131da26864f593bO ","884df847e417525Oa5a5c3eOedO83cfO ","19699828bd5ee7c8ebaa69cbOcd52e8e ","3O9267125434e8a4dO3af44f53818bb7","fb8bcbb48c36cc6c2f41O21d8e68efbc ","a1bffO8cd61471ecObO981eb31511b4a","2f64777bc62ea978b1ae98O2b4979cO4 ","5d9756e3f4c8e89ff23f7cab3Oc8c168 ","2337O46O839ad99ba513eb1595287f7f","7944332e65ad32d7b8O2e182346f5f1c","B41a248efde3dcOOf4b639da7f76fae1","7a9118O7Obae21eO323f343da1dOf8c9","D3864196cfO5bb812b27e698222df5aa")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1964a4b3a6dOd12d7ccee57658Oeba11 ","4d4a0052d093cc743db0776e04f7e449 ","3c7c684aed7O164d9b9bbdebee964db4 ","4b11f89O119f7cbd131da26864f593bO ","884df847e417525Oa5a5c3eOedO83cfO ","19699828bd5ee7c8ebaa69cbOcd52e8e ","3O9267125434e8a4dO3af44f53818bb7","fb8bcbb48c36cc6c2f41O21d8e68efbc ","a1bffO8cd61471ecObO981eb31511b4a","2f64777bc62ea978b1ae98O2b4979cO4 ","5d9756e3f4c8e89ff23f7cab3Oc8c168 ","2337O46O839ad99ba513eb1595287f7f","7944332e65ad32d7b8O2e182346f5f1c","B41a248efde3dcOOf4b639da7f76fae1","7a9118O7Obae21eO323f343da1dOf8c9","D3864196cfO5bb812b27e698222df5aa")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://minecraftsquid.hopto.org/ifo.php ","https://pastebin.com/raw/EGRcZWCa ","https://pastebin.com/raw/HMaz9edN")
